Set meaningful message from minio with env variable KMS_SECRET_KEY (#16584)

internal/kms/config.go

@@ -0,0 +1,32 @@
+// Copyright (c) 2015-2023 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+package kms
+
+// Top level config constants for KMS
+const (
+	EnvKMSSecretKey      = "MINIO_KMS_SECRET_KEY"
+	EnvKMSSecretKeyFile  = "MINIO_KMS_SECRET_KEY_FILE"
+	EnvKESEndpoint       = "MINIO_KMS_KES_ENDPOINT"     // One or multiple KES endpoints, separated by ','
+	EnvKESEnclave        = "MINIO_KMS_KES_ENCLAVE"      // Optional "namespace" within a KES cluster - not required for stateless KES
+	EnvKESKeyName        = "MINIO_KMS_KES_KEY_NAME"     // The default key name used for IAM data and when no key ID is specified on a bucket
+	EnvKESAPIKey         = "MINIO_KMS_KES_API_KEY"      // Access credential for KES - API keys and private key / certificate are mutually exclusive
+	EnvKESClientKey      = "MINIO_KMS_KES_KEY_FILE"     // Path to TLS private key for authenticating to KES with mTLS - usually prefer API keys
+	EnvKESClientPassword = "MINIO_KMS_KES_KEY_PASSWORD" // Optional password to decrypt an encrypt TLS private key
+	EnvKESClientCert     = "MINIO_KMS_KES_CERT_FILE"    // Path to TLS certificate for authenticating to KES with mTLS - usually prefer API keys
+	EnvKESServerCA       = "MINIO_KMS_KES_CAPATH"       // Path to file/directory containing CA certificates to verify the KES server certificate
+)

internal/kms/kes.go

@@ -28,6 +28,7 @@ import (
 
 	"github.com/minio/kes-go"
 	"github.com/minio/pkg/certs"
+	"github.com/minio/pkg/env"
 )
 
 const (
@@ -189,6 +190,26 @@ func (c *kesClient) Stat(ctx context.Context) (Status, error) {
 	}, nil
 }
 
+// IsLocal returns true if the KMS is a local implementation
+func (c *kesClient) IsLocal() bool {
+	return env.IsSet(EnvKMSSecretKey)
+}
+
+// List returns an array of local KMS Names
+func (c *kesClient) List() []kes.KeyInfo {
+	var kmsSecret []kes.KeyInfo
+	envKMSSecretKey := env.Get(EnvKMSSecretKey, "")
+	values := strings.SplitN(envKMSSecretKey, ":", 2)
+	if len(values) == 2 {
+		kmsSecret = []kes.KeyInfo{
+			{
+				Name: values[0],
+			},
+		}
+	}
+	return kmsSecret
+}
+
 // Metrics retrieves server metrics in the Prometheus exposition format.
 func (c *kesClient) Metrics(ctx context.Context) (kes.Metric, error) {
 	c.lock.RLock()

internal/kms/kms.go

@@ -32,6 +32,12 @@ type KMS interface {
 	// Stat returns the current KMS status.
 	Stat(cxt context.Context) (Status, error)
 
+	// IsLocal returns true if the KMS is a local implementation
+	IsLocal() bool
+
+	// List returns an array of local KMS Names
+	List() []kes.KeyInfo
+
 	// Metrics returns a KMS metric snapshot.
 	Metrics(ctx context.Context) (kes.Metric, error)
 

internal/kms/single-key.go

@@ -91,8 +91,23 @@ func (kms secretKey) Stat(context.Context) (Status, error) {
 	}, nil
 }
 
-func (secretKey) Metrics(context.Context) (kes.Metric, error) {
-	return kes.Metric{}, errors.New("kms: metrics not supported")
+// IsLocal returns true if the KMS is a local implementation
+func (kms secretKey) IsLocal() bool {
+	return true
+}
+
+// List returns an array of local KMS Names
+func (kms secretKey) List() []kes.KeyInfo {
+	kmsSecret := []kes.KeyInfo{
+		{
+			Name: kms.keyID,
+		},
+	}
+	return kmsSecret
+}
+
+func (secretKey) Metrics(ctx context.Context) (kes.Metric, error) {
+	return kes.Metric{}, errors.New("kms: metrics are not supported")
 }
 
 func (kms secretKey) CreateKey(_ context.Context, keyID string) error {